> For the complete documentation index, see [llms.txt](https://docs.nullify.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.nullify.ai/capabilities/pentests/supported-targets.md).

# Supported Targets

## Overview

The pentest workflow focuses on REST and GraphQL APIs. Surface discovery can use HTML, browser exploration, and JavaScript hints to find their deployed endpoints. [Bug Hunts](/capabilities/bug-hunts.md) provide broader external-surface discovery and selectable testing suites.

## Application Types

| Type                         | Supported                          | Notes                                                                                                                                           |
| ---------------------------- | ---------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- |
| **REST APIs**                | Yes                                | Serve an OpenAPI or Swagger specification as described in [Preparing for an Engagement](/capabilities/pentests/preparing-for-an-engagement.md). |
| **GraphQL APIs**             | Yes                                | Create the target as for REST, and give the GraphQL endpoint URL to your Nullify contact.                                                       |
| **SSR HTML Apps**            | Discovery and supported HTTP paths | HTML exploration can identify routes and authentication flows; confirm application-specific coverage before the engagement.                     |
| **SPAs**                     | Discovery and backing APIs         | JavaScript and browser discovery can inform endpoint coverage; this is not a promise to exercise every client-side state or interaction.        |
| **SOAP APIs**                | Not yet                            | Register interest with the Nullify team.                                                                                                        |
| **WebSockets**               | Not yet                            | Event-driven assessments are on the roadmap.                                                                                                    |
| **gRPC**                     | Not yet                            | Reach out if you would like to join the design partner programme.                                                                               |
| **Custom TCP/UDP Protocols** | Not yet                            | On the roadmap.                                                                                                                                 |

## APIs that carry XML

The pentester classifies a target as either REST or GraphQL. It can test an HTTP API that exchanges XML payloads as REST, provided an OpenAPI specification covers its endpoints.

A SOAP service is different. We do not support SOAP's envelope, WSDL contract, or operation dispatch, and a WSDL cannot stand in for an OpenAPI specification. If you are unsure which category your service falls into, send us the specification and we will confirm before the engagement starts.

## Network reachability

| Target location             | Pentest                                                                                                       | [Exploit validation](/capabilities/pentests/exploit-validation.md) |
| --------------------------- | ------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------ |
| Reachable from the internet | Yes                                                                                                           | Yes                                                                |
| Private network             | Yes — via the CLI local runner, see [Running in Private Networks](/capabilities/pentests/private-networks.md) | No                                                                 |

## Vulnerability coverage

Across supported target types the pentester tests for:

* Injection — SQL, NoSQL, command, LDAP, and XPath
* Broken authentication and broken authorization
* Insecure direct object references and broken object-level authorization
* Privilege escalation and authorization bypass across roles
* Server-side request forgery, subject to the engagement’s allowed destinations
* XML external entity processing
* Unsafe file upload
* Business logic flaws

Where an exploit succeeds within the authorized scope, the pentester attaches the requests and responses that support the result. A blocked or untested path remains a coverage limitation, not a clean verdict.